CVE-2026-54817CWE-288

WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability

Medium · published June 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.

This issue affects MStore API: from n/a through 4.18.4.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-06-17T13:36Z
EPSS history
Timeline
  • 17 JUN 13:36Z
    WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability
    cvelistv5